{"id":"CVE-2022-24464","published":"2022-03-09T17:07:46Z","modified":"2026-05-27T14:00:53Z","title":".NET and Visual Studio Denial of Service Vulnerability","vendor":"Microsoft","product":".NET 6.0","tier":"tail","description":{"text":".NET and Visual Studio Denial of Service Vulnerability","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03551,"percentile":0.89267,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24464","tags":["vendor-advisory"]}],"priority":{"score":23.1,"factors":[{"name":"EPSS percentile","points":17.85},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"microsoft","affectedVersions":[{"vendor":"Microsoft","product":".NET 6.0","versions":[">= 6.0.0, < 6.0.3"]},{"vendor":"Microsoft","product":".NET 5.0","versions":[">= 5.0.0, < 5.0.15"]},{"vendor":"Microsoft","product":".NET Core 3.1","versions":[">= 3.1, < 3.1.23"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)","versions":[">= 16.0.0, < 16.7.26"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)","versions":[">= 15.0.0, < 16.9.18"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)","versions":[">= 16.11.0, < 16.11.11"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.0","versions":[">= 17.0.0, < 17.0.7"]}],"affected":[{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-arm","vulnerableRanges":[">=3.0.0, <3.1.23",">=5.0.0, <5.0.15",">=6.0.0, <6.0.3"],"patched":["3.1.23","5.0.15","6.0.3"],"from":["GHSA-cw98-9j8w-wxv9"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-arm64","vulnerableRanges":[">=3.0.0, <3.1.23",">=5.0.0, <5.0.15",">=6.0.0, <6.0.3"],"patched":["3.1.23","5.0.15","6.0.3"],"from":["GHSA-cw98-9j8w-wxv9"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","vulnerableRanges":[">=3.0.0, <3.1.23",">=5.0.0, <5.0.15",">=6.0.0, <6.0.3"],"patched":["3.1.23","5.0.15","6.0.3"],"from":["GHSA-cw98-9j8w-wxv9"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","vulnerableRanges":[">=3.0.0, <3.1.23",">=5.0.0, <5.0.15",">=6.0.0, <6.0.3"],"patched":["3.1.23","5.0.15","6.0.3"],"from":["GHSA-cw98-9j8w-wxv9"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-x64","vulnerableRanges":[">=3.0.0, <3.1.23",">=5.0.0, <5.0.15",">=6.0.0, <6.0.3"],"patched":["3.1.23","5.0.15","6.0.3"],"from":["GHSA-cw98-9j8w-wxv9"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.osx-x64","vulnerableRanges":[">=3.0.0, <3.1.23",">=5.0.0, <5.0.15",">=6.0.0, <6.0.3"],"patched":["3.1.23","5.0.15","6.0.3"],"from":["GHSA-cw98-9j8w-wxv9"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-arm","vulnerableRanges":[">=3.0.0, <3.1.23",">=5.0.0, <5.0.15",">=6.0.0, <6.0.3"],"patched":["3.1.23","5.0.15","6.0.3"],"from":["GHSA-cw98-9j8w-wxv9"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-arm64","vulnerableRanges":[">=3.1.5, <3.1.23",">=5.0.0, <5.0.15",">=6.0.0, <6.0.3"],"patched":["3.1.23","5.0.15","6.0.3"],"from":["GHSA-cw98-9j8w-wxv9"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x64","vulnerableRanges":[">=3.0.0, <3.1.23",">=5.0.0, <5.0.15",">=6.0.0, <6.0.3"],"patched":["3.1.23","5.0.15","6.0.3"],"from":["GHSA-cw98-9j8w-wxv9"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x86","vulnerableRanges":[">=3.0.0, <3.1.23",">=5.0.0, <5.0.15",">=6.0.0, <6.0.3"],"patched":["3.1.23","5.0.15","6.0.3"],"from":["GHSA-cw98-9j8w-wxv9"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7083","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-microsoft-net-6-0-cve-2022-24464","packageHistory":[{"cve":"CVE-2020-1161","published":"2020-05-21","fixed":"3.1.4","kev":false,"link":{"from":"CVE-2020-1161","to":"CVE-2022-24464","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.win-x86","fromFixed":"3.1.4","toFixed":"3.1.23","daysApart":657}]}},{"cve":"CVE-2020-1045","published":"2020-09-11","fixed":"3.1.8","kev":false},{"cve":"CVE-2021-1723","published":"2021-01-12","fixed":"5.0.2","kev":false,"link":{"from":"CVE-2021-1723","to":"CVE-2022-24464","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.linux-arm","fromFixed":"3.1.11","toFixed":"3.1.23","daysApart":421},{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.linux-arm64","fromFixed":"3.1.11","toFixed":"3.1.23","daysApart":421},{"kind":"similar","provenance":"machine","score":0.81,"basis":"same product + description similarity"}]}},{"cve":"CVE-2022-21986","published":"2022-02-09","fixed":"6.0.2","kev":false,"link":{"from":"CVE-2022-21986","to":"CVE-2022-24464","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.linux-arm","fromFixed":"5.0.14","toFixed":"5.0.15","daysApart":28},{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.linux-arm","fromFixed":"6.0.2","toFixed":"6.0.3","daysApart":28},{"kind":"similar","provenance":"machine","score":0.25,"basis":"same package + description similarity"}]}},{"cve":"CVE-2022-24464","published":"2022-03-09","fixed":"6.0.3","kev":false},{"cve":"CVE-2022-23267","published":"2022-05-10","fixed":"6.0.5","kev":false,"link":{"from":"CVE-2022-24464","to":"CVE-2022-23267","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.linux-arm","fromFixed":"3.1.23","toFixed":"3.1.25","daysApart":62},{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.linux-arm","fromFixed":"5.0.15","toFixed":"5.0.17","daysApart":62},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + description similarity"}]}},{"cve":"CVE-2022-29117","published":"2022-05-10","fixed":"6.0.5","kev":false,"link":{"from":"CVE-2022-24464","to":"CVE-2022-29117","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.linux-arm","fromFixed":"3.1.23","toFixed":"3.1.25","daysApart":62},{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.linux-arm","fromFixed":"5.0.15","toFixed":"5.0.17","daysApart":62},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2022-29145","published":"2022-05-10","fixed":"6.0.5","kev":false,"link":{"from":"CVE-2022-24464","to":"CVE-2022-29145","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.linux-arm","fromFixed":"3.1.23","toFixed":"3.1.25","daysApart":62},{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.linux-arm","fromFixed":"5.0.15","toFixed":"5.0.17","daysApart":62},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + CWE + description similarity"}]}}],"package":"NuGet:Microsoft.AspNetCore.App.Runtime.linux-arm"}}